一种DDoS攻击的防御方案  

A Scheme to Prevent DDoS Attacks

作　　者：胡小新[1] 王颖[2] 罗旭斌 

机构地区：[1]电子科技大学计算机学院,成都610054 [2]中国铁道建筑总公司,北京100855 [3]上海复旦金士达研发中心,上海201203

出　　处：《计算机工程与应用》2004年第12期160-163,共4页Computer Engineering and Applications

摘　　要：分布式拒绝服务攻击(DDoS)是一种攻击强度大、危害严重的拒绝服务攻击。Internet的无状态特性使得防止DDoS攻击非常困难,尽管在学术界和工业界引起了广泛的重视,但目前仍然没有可行的技术方案来对付DDoS攻击。文章提出了一种在局部范围内消除DDoS攻击的综合方案,它包括入侵检测系统、IP标记、IP包过滤等功能,该方案具有操作简单、路由器负担小、易于部署、响应快等特点。Defense against distributed denial-of-service attacks is one of the hardest security problems on the Internet.Among those problems ,the most difficult problem is to trace the attacks back to its origin for the attackers always use incorrect or spoofed IP addresses in the attack packets.There isn't a feasible approach to deal with DDoS attack within the entire INTERNET up to now.In this paper,a system to work out it within an ISP or domain is proposed.The sys-tem,which consists of Intrusion Detection System(IDS),IP traceback(IP marking)and packet filtering subsystems ,is practical and easy to deploy.

关 键 词：分布式拒绝服务攻击 DDOS IP追踪 包过滤 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]